ci-cd

2 posts with the tag “ci-cd”

GitLab Tames the AI Agent Flood with Rate Limits and Cost Controls

Sep 21, 2026

Christopher Shaun Godwin

Author

GitLab Tames the AI Agent Flood with Rate Limits and Cost Controls

GitLab spent one week on two moves that look opposite. It tightened rate limits on GitLab.com (GitLab blog, 2026). Then it released GitLab 19.4 with more agentic automation than any prior release (BusinessWire, 2026). The two moves are one strategy. Agents are welcome, but they must be governed and paid for.

What changes on GitLab.com, and when

Starting October 19, 2026, rate limits on GitLab.com align with your subscription tier (GitLab blog, 2026). Free accounts and unauthenticated requests move first. Premium and Ultimate change in January 2027. Limits apply per user and per top-level group (GitLab blog, 2026).

The new limits cover API requests, web requests, and authenticated Git over HTTPS requests (InfoWorld, 2026). Users on the lowest payment tiers are affected first. So are unauthenticated requests, including automations running against a paid account without credentials (InfoWorld, 2026). An unauthenticated request gets 60 requests per hour per IP address (GitLab blog, 2026).

Before the deadline, GitLab runs two preview windows for free and unauthenticated traffic. They run on October 7 and October 14, from 15:00 to 19:00 UTC (GitLab blog, 2026; InfoWorld, 2026).

GitLab says most users are already inside the new limits, so most see no change (InfoWorld, 2026). The stated reason is scale. Demand is climbing, and GitLab expects platform load to grow several times over this year (GitLab blog, 2026). GitLab joins Anthropic and GitHub, which introduced similar rate limits for AI-heavy usage (InfoWorld, 2026). The change is GitLab.com-only. Self-managed and Dedicated installations are not affected (GitLab blog, 2026).

GitLab 19.4: the automation that comes with the limits

GitLab 19.4 landed the same week with agentic automation at every surface developers work in (IT Voice, 2026). The release notes describe most scope.

The /goal slash command in GitLab Duo CLI automates a whole objective. A separate model verifies the work against the stated goal at each step. The developer can stop the run, revise the goal, and restart (IT Voice, 2026).

The Duo Agent Platform adds three GitLab-hosted open-weight models. They are Kimi K3, MiniMax M3, and GLM 5.3. The new models get up to 4x more calls per GitLab Credit than many comparable frontier models (IT Voice, 2026). Group owners set the default model and curate which models teams may use (IT Voice, 2026).

The GitLab MCP server expands what outside agents can do. New tools trigger a pipeline, read a failed job’s trace, run a merge request from open through merge, search work items, and triage vulnerabilities (IT Voice, 2026). Read-only tools default to Always Allow. Write and delete tools default to Always Ask, so a reviewer checks before an agent changes anything (IT Voice, 2026).

Cost visibility is the piece platform owners asked for. Per-user caps appear on a dedicated settings page. Usage exports go down to the billable event and arrive by email with a secure download link. Developers see their own consumption for the first time (IT Voice, 2026). Duo Agent Platform in Slack ships as an experiment for Premium and Ultimate customers (IT Voice, 2026).

Manav Khurana, chief product and marketing officer at GitLab, frames the design. “The platform running the automation is what governs which tools an agent can touch and attributes what it consumes” (IT Voice, 2026). The same permissions that cover the code govern the agents, so there is no second permission model and no separate audit trail (IT Voice, 2026).

What this means for your pipeline

Authenticate every automation. Anonymous bots fall under the 60-requests-per-hour per-IP cap on October 19 (GitLab blog, 2026). Automations running against a paid account without credentials are treated as unauthenticated (InfoWorld, 2026). Signing in unlocks the full limit for your tier (GitLab blog, 2026).
Use the preview windows as a rehearsal. October 7 and October 14 are the chance to see which integrations break before October 19 (GitLab blog, 2026). A public status badge is one pattern GitLab calls out as likely to be affected (GitLab blog, 2026).
Budget agent capacity like compute. Open-weight models deliver up to 4x more calls per credit (IT Voice, 2026). Per-user caps and billable-event exports turn agent spend into a measurable line item (IT Voice, 2026).
Govern third-party agents with the setting you already have. MCP tools inherit the Duo Agent Platform rules, with Always Ask on writes (IT Voice, 2026). Teams can adopt third-party agents without maintaining a separate rule set (IT Voice, 2026).

The takeaway

Rate limits decide who uses the platform for free. The 19.4 controls decide who spends the organization’s agent budget (GitLab blog, 2026; BusinessWire, 2026). Together they turn agentic automation into an accountable cost instead of an open-ended risk. Check your unauthenticated traffic now, test during the preview windows, and treat agent credits as a line item you can measure (IT Voice, 2026).

GitLab's Perfect 10: One Request Reads Every File on Your Server

Sep 15, 2026

Christopher Shaun Godwin

Author

GitLab’s Perfect 10: One Request Reads Every File on Your Server

GitLab shipped patches on September 10 with a CVSS 10.0 advisory, the maximum score on the CVSS v3.1 scale (The Register, 2026). The flaw, CVE-2026-85706, lives in the repository commits API. It lets an unauthenticated attacker read arbitrary files from a self-managed GitLab server (Rapid7, 2026). Exploitation attempts started within roughly a day of the fix (Security Affairs, 2026). If you host GitLab yourself, this is the story to act on today.

The flaw: two failures, one request

GitLab attributes the bug to two layered weaknesses. The repository commits API lacked proper path confinement, and the endpoint was missing authentication enforcement (SOC Prime, 2026). The API built a file path from attacker input without confining it to the repository, and the vulnerable condition did not require a login (Horizon3, 2026). Together they let a remote attacker walk the path out of the repo and read files anywhere the GitLab process can reach.

The exploit is one HTTP POST request with a crafted file.path parameter (Security Affairs, 2026). No credentials, no plugin, no multifactor bypass. watchTowr assessed the exploitation complexity as low and predicted broad in-the-wild attacks the day after the fix shipped (watchTowr, 2026).

GitLab fixed the flaw in versions 19.1.8, 19.2.6, and 19.3.2 for Community Edition and Enterprise Edition. Every earlier supported release is vulnerable (Field Effect, 2026; AhnLab ASEC, 2026).

What one request can expose

Arbitrary file read on a GitLab server is a credential grab, not a curiosity. The files most teams store on that box include SSH keys, database credentials, deploy tokens, CI/CD variables, and cloud keys (Security Affairs, 2026). Those files give an attacker the repositories, runners, registries, and production deployments that GitLab orchestrates (SOCRadar, 2026). Dark Reading framed the outcome directly: a maximum-severity GitLab flaw puts software supply chains at risk (Dark Reading, 2026).

Typical file on a self-managed GitLab box	Why it matters
SSH keys	Direct access to repositories and hosts
Database credentials	Control of the GitLab database
Deploy and runner tokens	Impersonate pipelines and CI/CD jobs
CI/CD variables	Secret values injected into every build
Cloud keys	Access to the infrastructure GitLab deploys to

The confirmed behavior is file disclosure, not direct code execution (SOCRadar, 2026). The risk does not stop there. The disclosed files are usually the credentials that unlock code execution and lateral movement elsewhere (Bank Info Security, 2026).

The timeline: patch to exploit in under a day

Date	Event
Sept 10	GitLab ships 19.1.8, 19.2.6, and 19.3.2 with an advisory for CVE-2026-85706, one of 17 fixes (watchTowr, 2026)
~20 hours later	Exploitation and probing attempts observed, one request per hit (forkast, 2026)
Sept 11	CISA adds CVE-2026-85706 to the Known Exploited Vulnerabilities catalog (CyberSecurityNews, 2026)
Sept 12	Public proof-of-concept code circulates, lowering the skill bar further (SOC Prime, 2026)
Sept 14	The Register: “Perfect-10 GitLab bug under attack days after patch lands” (The Register, 2026)

CISA set the federal remediation due date at September 14 and marked the CVE for forensic triage under Binding Operational Directive 26-04 (Rapid7, 2026).

The rest of the batch

CVE-2026-85706 was one of 17 vulnerabilities fixed on September 10 (forkast, 2026). Two others deserve your attention:

CVE	CVSS	What it does
CVE-2026-87719	9.9	Insecure deserialization in the GraphQL subscription serializer. An authenticated user with Duo Chat access can pull Advanced Search configurations and credentials (GitLab Security, 2026; Rapid7, 2026)
CVE-2026-88765	8.5	Buffer overflow in the Unicode conversion wrapper. Remote code execution via crafted Git project exports (forkast, 2026)

GitLab’s own security response team made the practical point: install the complete patch release, not a single fix (GitLab Security, 2026). The 9.9 deserialization flaw needs the same release, and it can expose credentials of its own. Of the batch, only CVE-2026-85706 is known to be exploited in the wild so far (Rapid7, 2026).

Your checklist

Upgrade now. Move to 19.3.2, 19.2.6, or 19.1.8 depending on your track (watchTowr, 2026). Exploitation arrived before many teams finished reading the advisory.
Check for compromise before rotating anything. Look for POST requests to the commits API with a file.path parameter (Security Affairs, 2026). SOC Prime shipped detection content for the signal (SOC Prime, 2026).
Rotate exposed credentials. Tokens, SSH keys, CI/CD variables, and cloud keys must all change after the patch (GitLab Security, 2026).
Patch the whole release. A partial install leaves CVE-2026-87719 and the rest of the batch open (GitLab Security, 2026).
Treat exposure as an incident. A GitLab box with exposed SSH and a file-read hole is a source-code and secrets breach, not a patch ticket (Dark Reading, 2026).

Also today: Cisco’s email gateway under attack

Cisco patched a separate zero-day on September 15. CVE-2026-76461 is a SQL injection in the AsyncOS email parsing engine of the Secure Email Gateway, rated CVSS 9.8. An unauthenticated remote attacker can execute commands with root privileges, and Cisco confirms active exploitation (BleepingComputer, 2026; The Hacker News, 2026). It is the second Secure Email Gateway CVE in the KEV catalog after CVE-2025-20393 (SecurityWeek, 2026). If you run the appliance, the patch is the update.

The takeaway

CVE-2026-85706 is the new baseline for patch urgency in self-hosted DevOps. A CVSS 10.0 file read, no authentication, one request, exploited within a day and added to KEV in two (The Register, 2026). The fix versions are known, the detection signal is documented, and the credential rotation list is short (Rapid7, 2026). The only open question is whether your instance was scanned before you patched. Upgrade, audit, rotate, and assume the attackers already checked your version string.